# Date format failing in grok

**URL:** <https://discuss.elastic.co/t/date-format-failing-in-grok/103295>\
**Category:** Logstash\
**Created:** [October 10, 2017, 5:21am UTC](https://discuss.elastic.co/t/date-format-failing-in-grok/103295 "2017-10-10T05:21:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sreejiths](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@sreejiths](https://discuss.elastic.co/u/sreejiths)\
**Post date:** [October 10, 2017, 5:21am UTC](https://discuss.elastic.co/t/date-format-failing-in-grok/103295/1 "2017-10-10T05:21:44Z")

</div>

We are using ELK 5.2 for Network device syslog Analytics . Some devices is sending date format with a special character "_" in the beginning of date format for some reasons due to which grok is failing to match . Anyway i can ignore or match "_" in logstash grok .Please advice .Details are below ..

Log :" \<189\>61: \*Oct 10 11:03:44 SG: %OSPF-5-ADJCHG: Process 2, Nbr 1.2.5.6 on Tunnel15 from LOADING to FULL, Loading Done"

Date pattern : THETIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} %{DATA:TZ}:

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 10, 2017, 5:23am UTC](https://discuss.elastic.co/t/date-format-failing-in-grok/103295/2 "2017-10-10T05:23:50Z")

</div>

I assume you're talking about `*`. That's a metacharacter in regular expressions to if you want to match a literal one you have to escape it with a backslash.

---

<div class="post-metadata">

**Author:** ![sreejiths](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@sreejiths](https://discuss.elastic.co/u/sreejiths)\
**Post date:** [October 10, 2017, 7:04am UTC](https://discuss.elastic.co/t/date-format-failing-in-grok/103295/3 "2017-10-10T07:04:47Z")

</div>

> [@magnusbaeck](#):
>
> metacharacter in regular expressions

Thanks ..Got it ..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 7:04am UTC](https://discuss.elastic.co/t/date-format-failing-in-grok/103295/4 "2017-11-07T07:04:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.